Edit tour
Windows
Analysis Report
17323828261cfef277a3375a886445bf7f5a834ebb1cc85e533e9ac93595cd0e56ebd12426132.dat-decoded.exe
Overview
General Information
| Sample name: | 17323828261cfef277a3375a886445bf7f5a834ebb1cc85e533e9ac93595cd0e56ebd12426132.dat-decoded.exe |
| Analysis ID: | 1561552 |
| MD5: | 49dc4ee55a1efd095a37979f88b9080c |
| SHA1: | fedf426141c227a67df1dcde19182abc46cac369 |
| SHA256: | 1896c48f7355a6d6f54df73e79e1176a069f2df15a7afb09f77974fd4d08cf5e |
| Tags: | base64-decodedexeuser-abuse_ch |
| Infos: |  |
 | |
Errors
| |
Detection
XWorm
| Score: | 60 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Yara detected XWorm
Machine Learning detection for sample
PE file does not import any functions
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Yara signature match
Classification
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
|
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | DNS traffic detected: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Classification label: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | Path Interception | Path Interception | Direct Volume Access | OS Credential Dumping | System Service Discovery | Remote Services | Data from Local System | 1 Non-Application Layer Protocol | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Rootkit | LSASS Memory | Application Window Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| bg.microsoft.map.fastly.net | 199.232.214.172 | true | false | high | |
| s-part-0035.t-0009.t-msedge.net | 13.107.246.63 | true | false | high | |
| ax-0001.ax-msedge.net | 150.171.27.10 | true | false | high | |
| tse1.mm.bing.net | unknown | unknown | false | high |
⊘No contacted IP infos
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1561552 |
| Start date and time: | 2024-11-23 18:28:07 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 1m 42s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 2 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 17323828261cfef277a3375a886445bf7f5a834ebb1cc85e533e9ac93595cd0e56ebd12426132.dat-decoded.exe |
| Detection: | MAL |
| Classification: | mal60.troj.winEXE@0/0@1/0 |
| Cookbook Comments: |
|
- No process behavior to analyse as no analysis process or sample was found
- Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.
- Exclude process from analysis (whitelisted): dllhost.exe
- Excluded IPs from analysis (whitelisted): 20.198.118.190
- Excluded domains from analysis (whitelisted): client.wns.windows.com, wns.notify.trafficmanager.net, ocsp.digicert.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, mm-mm.bing.net.trafficmanager.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, ctldl.windowsupdate.com, arc.msn.com, wu-b-net.trafficmanager.net
- VT rate limit hit for: 17323828261cfef277a3375a886445bf7f5a834ebb1cc85e533e9ac93595cd0e56ebd12426132.dat-decoded.exe
⊘No simulations
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| ax-0001.ax-msedge.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Stealc | Browse |
| ||
| Get hash | malicious | PureLog Stealer | Browse |
| ||
| Get hash | malicious | Amadey, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Amadey, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| s-part-0035.t-0009.t-msedge.net | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| bg.microsoft.map.fastly.net | Get hash | malicious | Clipboard Hijacker, Cryptbot | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RedLine, SectopRAT | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
⊘No context
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 5.624513020147386 |
| TrID: |
|
| File name: | 17323828261cfef277a3375a886445bf7f5a834ebb1cc85e533e9ac93595cd0e56ebd12426132.dat-decoded.exe |
| File size: | 37'287 bytes |
| MD5: | 49dc4ee55a1efd095a37979f88b9080c |
| SHA1: | fedf426141c227a67df1dcde19182abc46cac369 |
| SHA256: | 1896c48f7355a6d6f54df73e79e1176a069f2df15a7afb09f77974fd4d08cf5e |
| SHA512: | d9d040c466d3f7194141038b35b660266de86b7432bb3f3543673a014498932bb4ffb6d295f2c7524dd654074d2ed7804afa68a1ee64740b88b72f80ceb180f3 |
| SSDEEP: | 384:J3iSuXGyOjxOpBu7LoSfLWrd5SfFLWAvPeNgJ0wpkFMAfNLT2OZwxcV2v99IkHEn:N3uX+vDWJbcQFm9YHOMhSk8A1 |
| TLSH: | ACF25C087F944317CAEEAFF1647361131630E217D913E75E88E88A9A3F37B848D457A6 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..../6g............................N.... ........@.. ....................................@................................ |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x40a54e |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x67362FC0 [Thu Nov 14 17:13:36 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: |
| Instruction |
|---|
| adc dh, byte ptr [ecx] |
| add eax, dword ptr [edi] |
| pop es |
| add al, 0Eh |
| adc dh, byte ptr [ecx] |
| or byte ptr [eax], cl |
| push es |
| adc byte ptr [ecx], al |
| add dword ptr [eax], ecx |
| push ds |
| add byte ptr [edx+ecx], al |
| add dword ptr [ecx], edx |
| inc eax |
| push es |
| and byte ptr [ecx], al |
| adc dword ptr [ecx], edi |
| adc dword ptr [ecx], edi |
| add al, 07h |
| add bl, byte ptr [eax+ecx] |
| push es |
| pop es |
| add ecx, dword ptr [esi] |
| adc dh, byte ptr [ecx] |
| sbb byte ptr [edi+eax], al |
| add dword ptr [01200505h], ebx |
| push cs |
| sbb eax, 02070505h |
| push cs |
| sbb eax, 07070E1Ch |
| sbb eax, 82120E05h |
| sub dword ptr [edx], edx |
| xor dword ptr [04051D08h], eax |
| push es |
| adc al, byte ptr [ecx+02200991h] |
| adc al, byte ptr [ecx-7DEEF16Fh] |
| push ebp |
| or byte ptr [eax], ah |
| add eax, dword ptr [ecx] |
| push cs |
| sbb al, 11h |
| sbb byte ptr [ecx+09h], 00000007h |
| add eax, dword ptr [edx] |
| adc al, byte ptr [ecx-667FED6Fh] |
| push es |
| and byte ptr [ecx], al |
| adc al, byte ptr [ecx+070B0E91h] |
| add al, 1Dh |
| add eax, 1C918112h |
| adc al, byte ptr [eax+02000699h] |
| sbb al, 1Ch |
| adc dl, byte ptr [08020006h] |
| sbb eax, 20090805h |
| add al, byte ptr [ecx] |
| adc al, byte ptr [ecx+6582113Dh] |
| adc byte ptr [edi], al |
| or dword ptr [1D1C1C05h], ebx |
| add eax, 1C1D1C1Ch |
| sbb eax, 05021D1Ch |
| add byte ptr [ecx], al |
| sbb eax, 070D0805h |
| pop es |
| sbb eax, 00000000h |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xa500 | 0x4b | .text |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xc000 | 0x4e8 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xe000 | 0xc | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x2000 | 0x8 | .text |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x2008 | 0x48 | .text |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x2000 | 0x8554 | 0x8600 | 802cd635c3ccf9e6c6a5a898b3b00653 | False | 0.5007579291044776 | data | 5.776067529058912 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rsrc | 0xc000 | 0x4e8 | 0x600 | 84057f68270633f81b842140f4ba14df | False | 0.451171875 | data | 4.126542210541905 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xe000 | 0xc | 0x200 | 27000fc89ae18356ef90bb167cf49798 | False | 0.267578125 | data | 2.1918471789870027 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 23, 2024 18:29:10.692059040 CET | 55744 | 53 | 192.168.2.6 | 1.1.1.1 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Nov 23, 2024 18:29:10.692059040 CET | 192.168.2.6 | 1.1.1.1 | 0x4ab3 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Nov 23, 2024 18:29:09.112019062 CET | 1.1.1.1 | 192.168.2.6 | 0xf61 | No error (0) | s-part-0035.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Nov 23, 2024 18:29:09.112019062 CET | 1.1.1.1 | 192.168.2.6 | 0xf61 | No error (0) | 13.107.246.63 | A (IP address) | IN (0x0001) | false | ||
| Nov 23, 2024 18:29:09.184062004 CET | 1.1.1.1 | 192.168.2.6 | 0xfa1f | No error (0) | 199.232.214.172 | A (IP address) | IN (0x0001) | false | ||
| Nov 23, 2024 18:29:09.184062004 CET | 1.1.1.1 | 192.168.2.6 | 0xfa1f | No error (0) | 199.232.210.172 | A (IP address) | IN (0x0001) | false | ||
| Nov 23, 2024 18:29:10.837023973 CET | 1.1.1.1 | 192.168.2.6 | 0x4ab3 | No error (0) | mm-mm.bing.net.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Nov 23, 2024 18:29:10.837023973 CET | 1.1.1.1 | 192.168.2.6 | 0x4ab3 | No error (0) | 150.171.27.10 | A (IP address) | IN (0x0001) | false | ||
| Nov 23, 2024 18:29:10.837023973 CET | 1.1.1.1 | 192.168.2.6 | 0x4ab3 | No error (0) | 150.171.28.10 | A (IP address) | IN (0x0001) | false |
⊘No statistics
⊘No system behavior
⊘No disassembly